Linux Systems Engineer
I help run large-scale search and log pipelines at a managed detection and response provider in South Africa: Elastic and OpenSearch clusters, the SIEM they power, and Puppet and Python across hardened Linux nodes.
Cybersecurity Platform Engineer
Nclose (Integrity360)
Afrihost, April 2021 to August 2023; Nclose, September 2023 to now.
… in tech… at Nclose
Search and log platform
0kEPS
events per second · average ingest, across clients
EPS: events per second: How many security events (log lines, alerts, audit records) the SIEM takes in, reads and stores every second, on average across all the clients it serves. 200k EPS is roughly 17 billion events a day.Total managed nodes
350+
Linux nodes · hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Forward deployments
0+
deployments delivered · for enterprise clients
Forward deployments: Work delivered directly in a client's own environment. More than 15 so far, for enterprise clients in consumer finance, higher education, local government, oil and gas, retail and hospitality.Search and log platform
0
cluster nodes · across 5+ search clusters
Cluster nodes: Elastic and OpenSearch are search engines built for huge volumes of logs. My team and I run 5+ clusters of them, 220 servers in all, including the SIEM (security information and event management): the system that gathers security records from across a business so analysts can spot and stop attacks.Search and log platform
~0PB
of data · about 2,000 laptops' worth
PB: petabytes: A petabyte is a million gigabytes. The clusters hold roughly 2 PB of data, about as much as 2,000 laptops with 1 TB drives.Search and log platform
0kEPS
events per second · average ingest, across clients
EPS: events per second: How many security events (log lines, alerts, audit records) the SIEM takes in, reads and stores every second, on average across all the clients it serves. 200k EPS is roughly 17 billion events a day.Total managed nodes
350+
Linux nodes · hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Tap for the next figure, hold one for details
Press and hold a figure for details
Total managed nodes
350+
Linux nodes
hardened and managed with Puppet
Linux nodes: A node is a single server. I look after more than 350 of them, locked down against attack (hardened) and kept consistent with Puppet, a tool that sets up every server from one central place.Search and log platform
cluster nodes
220
of data
~2PB
average ingest
200kEPS
Forward deployments
15+
deployments delivered
for enterprise clients
Forward deployments: Work delivered directly in a client's own environment. More than 15 so far, for enterprise clients in consumer finance, higher education, local government, oil and gas, retail and hospitality.About
I've always thought in systems. Give me something broken and a terminal, and I'll find out why. Working things out on my own is what hooked me, and it still does.
I finished school in 2020, started on a support desk in 2021, and taught myself the rest. When something technical won't budge, people come to me: I've mentored 10 to 20 colleagues across both jobs.
Quick facts
- OFF THE CLOCK
- Basketball, chess, guitar
Case studies
- 01
Phased Ubuntu to Debian migration of log collectors across three offices
How I moved a financial asset manager's log collectors to new Debian machines, one kind of log source at a time.
Read case study
- 02
Applying an updated ISM policy to existing OpenSearch indices
Why the team kept deleting old indices by hand, and the fix that made retention run on its own.
Read case study
- 03
OpenSearch diagnostics and capacity forecasting tooling
Built so the team stops firefighting the OpenSearch clusters and starts planning for them.
Read case study
Hiring a platform or observability engineer?
Tell me about the role and your team's time zone. I usually reply within a day.